CVE-2021-24313

The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.

• CWE-79

• https://bastijnouwendijk.com/cve-2021-24313/Exploit, Technical Description, Third Party Advisory
• https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586Exploit, Third Party Advisory
• https://bastijnouwendijk.com/cve-2021-24313/Exploit, Technical Description, Third Party Advisory
• https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586Exploit, Third Party Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24308The 'State' field of the Edit profile page of the LMS by Lif…5.4
• CVE-2021-24309The "Schedule Name" input in the Weekly Schedule WordPress p…5.4
• CVE-2021-2431Vulnerability in the Oracle Outside In Technology product of…7.5
• CVE-2021-24310The Photo Gallery by 10Web - Mobile-Friendly Image Gallery W…4.8
• CVE-2021-24311The wp_ajax_upload-remote-file AJAX action of the External M…8.8
• CVE-2021-24312The parameters $cache_path, $wp_cache_debug_ip, $wp_super_ca…7.2
• CVE-2021-24314The Goto WordPress theme before 2.1 did not sanitise, valida…9.8
• CVE-2021-24315The GiveWP – Donation Plugin and Fundraising Platform WordPr…4.8
• CVE-2021-24316The search feature of the Mediumish WordPress theme through …6.1
• CVE-2021-24317The Listeo WordPress theme before 1.6.11 did not properly sa…6.1
• CVE-2021-24318The Listeo WordPress theme before 1.6.11 did not ensure that…6.5
• CVE-2021-24319The Bello - Directory & Listing WordPress theme before 1.6.0…5.4